Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 2901 to 2950 of 3,335 Grade C entries. Page 59 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:15 prepareWeb Search Mcp (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) server that gives any MCP client web search powered by the Google Custom Search API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
packages/dsh-web/src/tools.ts:765 return operations.fetch(normalizeFetch(args), exec.signal);web (MCP server)
Compatibility: Not stated.
Guion Web is a Node.js web research toolkit.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
README_CN.md:17 curl -sSL https://raw.githubusercontent.com/fastclaw-ai/weclaw/main/install.sh | shweclaw (MCP server)
Compatibility: Not stated.
Go to the project page here:
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
wp-ai-bridge/admin/views/api-keys-section.php:541 fetch(ajaxurl, {Wp Ai Bridge (MCP server)
Compatibility: Not stated.
A WordPress plugin that exposes secure REST endpoints for content management via **per-user API keys** or **OAuth2** (Authorization Code flow).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
audit/run2.mjs:90 const html = await fetch("http://127.0.0.1:8090/").then((r) => r.text()).catch(() => "");wpxmcp (MCP server)
Compatibility: Not stated.
**The open-source MCP server that runs your WordPress sites like a senior admin would** , content, design, plugins, SEO, performance, security and the whole fleet, from Claude, ChatGPT, Cursor or any MCP client.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
server/harness/bridge.py:411 if event in ("subprocess.Popen", "os.system", "os.exec", "os.posix_spawn", "os.foAgent Ops (Plugin)
Compatibility: Not stated.
Manage Codex, Claude Code and Kiro CLI conversations and runs locally.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
caveman-compress/scripts/compress.py:40 result = subprocess.run(Agent Skills (Skill)
Compatibility: Not stated.
Eight Claude Code skills I designed and built, plus two entries adapted from Julius Brussee's [caveman](https://github.com/JuliusBrussee/caveman) (MIT), all curated down from a larger private set to the ones I use daily.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
structural-refactor/SKILL.md:77 bash <(curl -sL get-comby.netlify.app) # Ubuntu/DebianAgent Skills (Skill)
Compatibility: Not stated.
A collection of shareable, high-quality AI coding agent skills and workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
diary/benchmarks/measure_journal_generation.py:158 cli_version = subprocess.check_output(["codex", "--version"Agent Toolkit (Skill)
Compatibility: Not stated.
A collection of tools and frameworks for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
install.sh:10 # curl -fsSL https://raw.githubusercontent.com/erikhoward/agent-tools/main/install.sh | bashAgent Tools (Skill)
Compatibility: Not stated.
A curated set of opencode [agents](agents/), [commands](commands/), [skills](skills/), and a global [AGENTS.md](AGENTS.md) , the flow workflow (ideate → plan → implement), Git helpers, and language skills.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
src/agent_xplat/diff.py:47 completed = subprocess.run(Agent Xplat (Skill)
Compatibility: Not stated.
> Find the OS assumptions that break AI-agent workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
scripts/generate_starter.py:28 shutil.rmtree(destination)Agentic Gtm (Skill)
Compatibility: Not stated.
Fifteen GTM skills with playbooks, backed by a deterministic, approval-gated CLI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
skills/agentui-automations/SKILL.md:35 const { data } = await axios.get(inputs.url);Agentui Tools (Skill)
Compatibility: Not stated.
Deploy and host apps on AgentUI from your coding agent.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
examples/call_agy.py:194 proc = subprocess.run(Agy Sub Agent (Skill)
Compatibility: Not stated.
Delegate a self-contained subtask to Antigravity (official `agy` CLI, headless) and retrieve a structured JSON result.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
inertia-react/skills/laravel-inertia-react/rules/form-file-uploads.md:24 await fetch('/upload', {Ai Toolkit (Skill)
Compatibility: Not stated.
Agent skills for deep code review and grounded investigation in PHP, TypeScript, Python and beyond, plus dedicated Laravel and React packs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
package.json:46 prepareAIpush (Skill)
Compatibility: Not stated.
**Get recommended by ChatGPT, Perplexity & Gemini , automatically.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
alluvia/checks.py:87 process = subprocess.Popen(argv, cwd=cwd, env=env, stdin=subprocess.DEVNULL,alluvia (Skill)
Compatibility: Not stated.
Remember this repository's decisions and turn corrected Python behavior into a regression test with /alluvia:protect.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
mcp-servers/nextdns/src/client.ts:78 const response = await fetch(url, {Alpha Skills (Skill)
Compatibility: Not stated.
A homelab skills repository with two purposes that stay strictly separate: a growing collection of [Agent Skills](https://agentskills.io) meant for publishing to [skills.sh](https://www.skills.sh), and a set of local MCP servers built on top of those same skills' reference docs,
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/aws_test_plugin/scripts/run_tests.py:70 result = subprocess.run(cmd, cwd=root, check=False)Aws Test Plugin (Skill)
Compatibility: Not stated.
AI-powered test generation skills for AWS Python projects , Lambda, API Gateway, Step Functions, and Batch.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/bank_agent_llm/cli.py:61 def fetch(Bank Agent Llm (Skill)
Compatibility: Not stated.
Local-first, AI-powered pipeline for personal financial intelligence.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
scripts/check-code-blocks.py:17 p=subprocess.run(['bash','-n'],input=src,text=True,capture_output=True)Baodao Skill (Skill)
Compatibility: Not stated.
<p align="center"> <a href="https://tahodev.github.io/baodao-skill/"> <img src="https://tahodev.github.io/baodao-skill/emblem.png" alt="baodao-skill 青花台字印章標誌" width="120"> </a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
skills/pre-merge-check/scripts/check_dependencies.py:30 return subprocess.run(cmd, cwd=cwd, capture_output=TruBaseline Skills (Skill)
Compatibility: Not stated.
Three [Agent Skills](https://github.com/anthropics/skills) that give any AI coding agent (Claude Code, Codex CLI, Antigravity, Cursor, Windsurf, and anything else that speaks the open Agent Skills format) a working default for secure, well-set-up software, without you having to w
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +3 more
bootstrap/src/checksum.test.ts:19 fs.rmSync(p);berimor (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
bigquery-blockchain-datasets/scripts/regenerate-schema-tables.py:37 p = subprocess.run(cmd, capture_output=TruBigquery Blockchain Skills (Skill)
Compatibility: Not stated.
Agent Skills ([agentskills.io](https://agentskills.io)) for querying the BigQuery public blockchain datasets: `goog_blockchain_{ethereum_mainnet,polygon_mainnet,arbitrum_one,optimism_mainnet,avalanche_contract_chain,cronos_mainnet,tron_mainnet}_us`, `crypto_ethereum`, and `crypto
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/bitwarden_lease_broker.py:70 completed = subprocess.run(Bitwarden Lease (Skill)
Compatibility: Not stated.
Install, operate, diagnose, and safely consume an owner-only macOS Bitwarden CLI lease that uses one native hidden-answer unlock interaction for a 24-hour process-continuity window.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
doctor/bouch-doctor:88 p = subprocess.run(Bouch Plugins (Skill)
Compatibility: Not stated.
UK-specific Claude Code plugins for property investors, solicitors, small business owners, and project managers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
breakthrough-whatsapp-triage/scripts/wa_doctor.py:179 result = subprocess.run([sys.executable, "-m", "pip", "-Breakthrough Whatsapp Triage (Skill)
Compatibility: Not stated.
A Claude Code skill that turns an overwhelming WhatsApp backlog into a one page action board.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
plugins/carnap-auto-research/install.py:31 subprocess.run(command, check=True)Carnap Harness (Skill)
Compatibility: Not stated.
**Turn open-ended research into an evidence workflow that can be inspected, advanced, and stopped.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
docs/demo/gen.mjs:6 fs.rmSync(root, { recursive: true, force: true });ccfind (Plugin)
Compatibility: Not stated.
Full-text search across your past Claude Code sessions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
packages/watch-video/skills/watch-video/scripts/doctor.py:235 result = subprocess.run(charms (Skill)
Compatibility: Not stated.
Charms is a monorepo of two independent, portable [Agent Plugins v1](https://agent-plugins.org/specification).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
install.js:85 fs.rmSync(skillDest, { recursive: true, force: true });checkmyvibe (Skill)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
.claude/skills/evidence-driven-testing/scripts/evidence.py:100 result = subprocess.run(Claude Code Harness (Skill)
Compatibility: Not stated.
A curated harness for Claude Code: **13 specialized agents**, **16 skills**, and a six-beat **AGENTS.md workflow** that takes a task from an isolated worktree to an evidence-backed pull request.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zInuUMSD0" style="display:none">q7uiAHHV+pJpj1W8/FRZS5ekGwgOhe5NAOk30HzcO8Odpq4Kc8W96DDCClaude Feedback Rings (Plugin)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zWTKhJkQ0" style="display:none">F3VApjB3RBUR3uBYyCPM/SnJgBU9VqyhEPmVdMRDUUohaEysMmcDb0iTClaude Plugins Weave (Plugin)
Compatibility: Not stated.
**WeaveFlow** is an innovative open-source framework that transforms how AI agents communicate, share context, and execute complex workflows across multiple plugin ecosystems.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
plugins/github-multi-account/skills/setup/references/git.md:12 ssh-keygen -t ed25519 -C "<email1> $(hostname -Claude Skills (Skill)
Compatibility: Not stated.
Skills for Claude Code, packaged as installable plugins.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
README.md:154 Agentic Stack authenticates with **OpenAI API** using environment variables or a `.env` file. ThCli Boot Agents (Plugin)
Compatibility: Not stated.
**Version 1.0.0 | MIT License | 2026 Release**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/guard_sensitive_paths.py:34 r"(^|[\s\\/])\.npmrc($|[\s\"'`;<>|&])",Copilot Harness (Skill)
Compatibility: Not stated.
Drop-in harness for a bare GitHub Copilot: instructions, skills, custom agents, MCP config, guard hook, and a cost playbook for token-based billing.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_UNCONFIRMED
update_package_version.py:55 result = subprocess.run(Dbr Project Sample (Skill)
Compatibility: Not stated.
Reference implementation for a Python library that runs locally through [Databricks Connect](https://docs.databricks.com/aws/en/dev-tools/databricks-connect/python/) and as an installed [Python wheel](https://packaging.python.org/en/latest/specifications/binary-distribution-forma
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED OBFUSCATION_ENCODED_BLOB
skill/ocio-color/scripts/_command.py:25 return subprocess.run(list(args), check=True, capture_output=True, texDcc Texture Pipeline (Skill)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/dcc-texture-pipeline.svg" alt="DCC-MCP · TEXTURE-PIPELINE" width="600"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
demo-generator/setup/check-dependencies.sh:34 check "uv" "uv" "" "curl -LsSf https://astral.sh/uv/install.sh |Dev Toolbox (Skill)
Compatibility: Not stated.
Standalone dev tools and AI infrastructure I built for my own workflow.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
devlog_recorder/media.py:12 r = subprocess.run(["node", str(ENGINE / "capture.js"), str(p)], cwd=str(ENGINE.paDevlog Recorder (Skill)
Compatibility: Not stated.
Keep a video-ready record of a session while it happens, whatever the session is.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
apps/web/src/lib/api.ts:52 const res = await fetch(`${API_BASE}${path}`, {Dfl Skills (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
src/diagram/useDiagram.ts:21 const response = await fetch(`/__diagrams/${path}`, init);Diagram Canvas Skill (Skill)
Compatibility: Not stated.
An agent skill for drawing architecture and workflow diagrams together with a coding agent.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
install.sh:5 # Remote: curl -fsSL https://raw.githubusercontent.com/OWNER/discovery-os/main/install.sh | bashDiscovery Os (Skill)
Compatibility: Not stated.
A master product discovery system for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
skills/record-browser-gif/scripts/encode_gif.py:70 completed = subprocess.run(command, check=True, capture_outDsh Generalized Skills (Skill)
Compatibility: Not stated.
中文 | [English](README-en.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:17 prepareDw Solo Skills (Skill)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/dw-solo-skills-hero-v2.png" alt="dw-solo-skills , a persistent workflow from idea to merge" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/dev/setup-rellog.sh:5 curl -fsSL https://raw.githubusercontent.com/tooppoo/rellog/refs/heads/main/instenozunu (Skill)
Compatibility: Not stated.
<img src="./docs/assets/enozunu-icon.png" height="200" width="auto">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zsCU2abX0" style="display:none">8BStUk01ZIjAyoaMtxhcDcBHK9CgUvR81Tf0LgKRF4LGCaFYTyUj8pmHGaap To Global Reporter (Plugin)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
gallery/verdant/tools/configure_input.py:18 result = subprocess.run(command, capture_output=True, text=True, cgallery (Skill)
Compatibility: Not stated.
**Playable Godot demos developed and verified with AI agents using gda and AIGen Game Agent Skills.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
agentic-ai-explained/src/bridge.js:41 const res = await fetch(`${BASE_URL}/health`, { signal: AbortSignal.any(Generative Ai Explained (Skill)
Compatibility: Not stated.
An animated, client-side slide deck that teaches how large language models and AI agents work , from raw text to sampled token, and from a single forward pass to a full agent loop.
This grade is a hygiene screen, not proof of safety.
